SB20261110335 - Multiple vulnerabilities in PUPnP

Description

This security bulletin contains information about 2 vulnerabilities.

1) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by crashing a UPnP control-point process.

The vulnerability exists due to an out-of-bounds read caused by improper null termination in PUPnP's http_Download() when processing chunked XML responses. A remote attacker on the local network can serve a chunked response with an extra CRLF after the terminating chunk from a URL downloaded through UpnpDownloadXmlDoc() to make the XML parser read beyond the allocated buffer and potentially crash the process.

2) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through heap corruption and process crashes.

The vulnerability exists due to incorrect alias reference counting causing use-after-free and possible double free in PUPnP's web server when replacing an XML alias still used by a response worker. A remote attacker can request a config_baseURL device description and stall reading its response while the embedding application unregisters and registers a replacement device, causing premature release of the worker's XML and reference-count object to trigger a crash.

Remediation

Install update from vendor's website.

References

• https://github.com/pupnp/pupnp/security/advisories/GHSA-7vj7-3hjc-p8q9
• https://github.com/pupnp/pupnp/security/advisories/GHSA-wcf8-pjfj-w9wv